Merge branch 'main' into feat/257-semgrep-silent-success-masking

Author: krokoko

.github/workflows/build.yml

@@ -0,0 +1,81 @@
+name: security-pr
+# Fast, required-on-PR security gate (issue #327). Catches the incident class
+# (#313: secrets reaching history because the scan only ran weekly) at PR time.
+#
+# Scope is deliberately the FAST scanners only — secrets (range-scoped),
+# dependencies, and workflow static-analysis — so this stays off the slow path
+# (<~3 min) and can be a required status check without throttling the inner loop.
+# The heavy image + SAST suite (trivy/grype/semgrep) runs in security.yml and is
+# tracked separately by #235; the full-history secret sweep also lives there.
+on:
+  pull_request: {}
+  # Must also run on merge_group so this check reports inside the merge queue;
+  # otherwise marking it a required check deadlocks the queue. See #327.
+  merge_group: {}
+  workflow_dispatch: {}
+
+# Least privilege: read the code, nothing else.
+permissions:
+  contents: read
+
+concurrency:
+  group: security-pr-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  secrets-deps-actions:
+    name: Secrets, deps, and workflow scan
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    permissions:
+      contents: read
+    env:
+      CI: "true"
+      MISE_EXPERIMENTAL: "1"
+      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      AQUA_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          # Full history so the range scan can resolve the base ref. A shallow
+          # clone would leave origin/<base> unresolvable for the commit-range diff.
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Install mise
+        uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4.0.1
+        with:
+          cache: true
+
+      - name: Resolve PR commit range
+        id: range
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: |
+          set -euo pipefail
+          case "$EVENT_NAME" in
+            pull_request)
+              # Scan exactly the commits this PR introduces.
+              echo "range=${PR_BASE_SHA}..${PR_HEAD_SHA}" >> "$GITHUB_OUTPUT"
+              ;;
+            merge_group|workflow_dispatch|*)
+              # In the merge queue (and on manual dispatch) there is no PR diff to
+              # scope to; scan the full reachable history as a backstop.
+              echo "range=" >> "$GITHUB_OUTPUT"
+              ;;
+          esac
+          echo "Resolved GITLEAKS_RANGE='$(tail -n1 "$GITHUB_OUTPUT" | cut -d= -f2-)'"
+
+      - name: Secret scan (gitleaks, PR range)
+        env:
+          GITLEAKS_RANGE: ${{ steps.range.outputs.range }}
+        run: mise run security:secrets:range
+
+      - name: Dependency scan (osv-scanner)
+        run: mise run security:deps
+
+      - name: Workflow static analysis (zizmor)
+        run: mise run security:gh-actions

.github/workflows/security-pr.yml

@@ -18,6 +18,12 @@ experimental = true
 node = "22"
 prek = "latest"
 gitleaks = "latest"
+# uv must be declared so it is on PATH before semgrep installs: mise's
+# `pipx.uvx` default routes pipx tools through `uv tool install` when uv is
+# present, avoiding the classic-pipx "Failed to upgrade shared libraries" path
+# that breaks under the mise 2026.6.x default `minimum_release_age`
+# (jdx/mise#10279; see #320).
+uv = "latest"
 semgrep = "latest"
 osv-scanner = "latest"
 "grype" = "latest"
@@ -102,12 +108,23 @@ run = [
 ##################
 
 [tasks."security:secrets"]
-description = "Scan for secrets with gitleaks"
-run = "gitleaks detect --source . --no-banner"
+description = "Scan all git history for secrets with gitleaks (full-history sweep)"
+# `gitleaks git` (history-aware) replaces the deprecated `gitleaks detect`
+# (removed from --help in v8.19.0). With no --log-opts this scans the full
+# history reachable from the checkout, matching the previous behaviour.
+run = "gitleaks git . --no-banner --redact"
+
+[tasks."security:secrets:range"]
+description = "gitleaks over a commit range only (per-PR gate). Set GITLEAKS_RANGE, e.g. origin/main..HEAD"
+# Range-scoped scan: only the commits a branch/PR introduces, not full history.
+# Defaults to the full history when GITLEAKS_RANGE is unset so the task is safe
+# to run anywhere. The per-PR CI job sets GITLEAKS_RANGE=origin/$BASE..HEAD.
+run = 'gitleaks git . --no-banner --redact --log-opts="${GITLEAKS_RANGE:-}"'
 
 [tasks."security:secrets:staged"]
 description = "gitleaks on staged changes (pre-commit hook)"
-run = "gitleaks protect --staged --no-banner"
+# `gitleaks git --staged` replaces the deprecated `gitleaks protect --staged`.
+run = "gitleaks git . --staged --no-banner --redact"
 
 [tasks."security:sast"]
 description = "SAST scan with semgrep (auto + OWASP top 10)"